NDAA Provision Represents Biggest Expansion of Export Control Authority in Years, Lawmaker Says

A small change to U.S. export regulations included in the fiscal year 2023 defense spending bill could go a long way to restricting shipments of sensitive U.S. technology, including hacking tools, lawmakers said this week. The provision, which passed as part of the National Defense Authorization Act last week, “represents the largest expansion of presidential export control authority in several years,” Rep. Tom Malinowski’s office said Dec. 21, adding that it allows the president to treat exports of hacking technology and expertise “just as we treat the export of sensitive military technology, to make sure it doesn’t fall into dangerous hands.”

The change will modify wording in the Export Control Reform Act to allow the U.S. to limit certain sensitive exports to foreign civilian intelligence or a “police-type entity,” said Malinowski, D-N.J. Current law allows the president to block only those exports to a foreign military intelligence agency, he said. “Americans should not be helping foreign dictatorships spy on their political opponents or on our own citizens.”

The change comes nearly a year after Senate and House Democrats called on the Biden administration to designate more spyware technology companies for human rights abuses, which they said will help the U.S. curb sales of surveillance technologies to authoritarian governments (see 2112150034). They said more sanctions would build on the administration's efforts to impose export restrictions on surveillance technology companies, including its November 2021 addition of NSO Group and three others to the Entity List (see 2111030010).

Under the new provision, President Joe Biden “could prohibit Americans from providing support” to “any of the dozens of security agencies round the world that have used advanced technology -- such as the NSO Group’s Pegasus spyware -- against journalists, human rights defenders, and opposition politicians,” Malinoswki said.

The new provision was applauded by at least one Republican. Sen. John Cornyn, R-Texas, said the change will “strengthen the ability of the American government to deny services to foreign civilian intelligence agencies,” adding that the U.S. needs to do more to “prevent American technology from falling into the wrong hands.”

Sen. Ron Wyden, D-Ore., said he plans to follow up with the administration after the NDAA becomes law to make sure the U.S. is using its export control authorities to stop shipments of sophisticated hacking tools. “American technology shouldn’t be used to help authoritarians spy on their citizens or hack their political rivals,” Wyden said.